Be Callable Before You Become Autonomous.
A verified read on what businesses must expose to software buyers, why the transaction economics remain unproved, and which authority and evidence controls must survive.
It is reasonable to expose one machine-usable purchase flow if the sponsor can name the governing authority, counterparty agreement, spend envelope, revocation path, exception owner, and transaction receipt. Do not call it a new customer channel until production evidence shows incremental completed demand or lower cycle cost after fraud, returns, disputes, integration, monitoring, approval, and exception labor.
The sign-off test
Expose authoritative product identity, price, availability, terms, seller identity, and freshness in a machine-readable form.
Bind the principal, agent, merchant or payee, amount, goods scope, duration, approval trigger, and prohibited cases.
Preserve merchant, payment, tax, fulfillment, disclosure, and record-retention duties at the correct legal boundary.
Prove revocation, rejection, refund, dispute ownership, duplicate prevention, and receipt reconstruction separately.
Owner, briefing, proof
Owner
A business sponsor who convenes the legal, privacy, security, finance, procurement or consumer, payment, and operations authorities that apply to the use case.
Briefing
The exact purchase class, jurisdiction, counterparties, outcome, baseline, authority envelope, exception path, and two explicit no-scale conditions.
Proof
A replayable record linking principal instruction, agent identity, seller, amount, policy result, approval, order events, revocation state, and final remedy.
What leaders should take from it
OpenAI, Stripe, Visa, and Mastercard have live or pilot mechanics for discovery, checkout, agent-bound credentials, and transaction evidence. Public primary sources still do not disclose a comparable agent-originated outcome cohort.
Documented flows preserve the merchant's payment, fulfillment, returns, support, communication, and merchant-of-record duties. Electronic contracting also preserves attribution, acceptance, and substantive law.
Leading designs converge on credentials and policies bounded by a principal, agent, merchant, amount, instruction, time window, or purchase category. The strategic fight is who owns and interprets that record.
Historical EDI, current sourcing automation, and consumer-choice research all point toward known counterparties, stable terms, deterministic limits, measurable baselines, and explicit exceptions before open-ended purchasing.
Prompt-injection and product-position studies reveal real mechanisms, while their rates remain specific to models, tasks, and synthetic or benchmark environments. They do not quantify payment loss or remedy cost.
No reviewed primary source reports agent-originated conversion, completed orders, contribution margin, protocol take rate, fraud, disputes, returns, and exception labor on one denominator. The evidence also does not establish one lawful delegation design across consumer and business purchases, jurisdictions, payment methods, or data categories.
The findings in full
OpenAI's initial Instant Checkout let a buyer confirm an order in ChatGPT while the merchant remained merchant of record and owned payment, fulfillment, returns, support, and communication. Stripe documented a seller-side protocol lifecycle. OpenAI later shifted its checkout direction toward merchant-owned flows while retaining product discovery. The durable change is a machine interface across discovery, selection, authorization, and handoff.
Visa and Mastercard center agent-bound credentials, authenticated instructions, scoped tokens, and evidence of intent. US electronic-contract and consumer-payment law preserve attribution, authority, revocation, proof, and liability. EU payment rules bind strong authentication to amount and payee where they apply.
Visa and Shopify operate at enormous transaction scale, and Mastercard made a material security acquisition. Those facts identify a valuable control point. They do not measure incremental agent demand, margin, fraud, return, or exception economics. OpenAI's product shift shows the architecture remains unsettled, not that demand failed.
GAO found EDI could be very effective for routine one-to-one orders and invoices among established partners. Oracle limits autonomous sourcing through configured policy, although human approvals are not guaranteed unless enabled. Scenario experiments also found lower stated adoption intent when AI delegation reduced perceived choice or autonomy.
InjecAgent reports benchmark-specific indirect-injection success for a GPT-4 agent. Task Shield sharply reduced targeted success in one AgentDojo condition while retaining partial utility. ACES reports product-position effects in a synthetic marketplace. None of these studies estimates real transaction loss, chargebacks, or recovery outcomes.
First moves before scaling agent commerce
For one flow, define authoritative product, price, availability, terms, seller, checkout, payment, order-event, fulfillment, return, dispute, disclosure, consent, accessibility, retention, and receipt fields.
Name the principal, agent, merchant or payee, amount, goods scope, duration, approval trigger, prohibited cases, revocation path, evidence custodian, and dispute owner. A refusal keeps the flow in research or simulation.
Use counterparties whose agreements permit electronic-agent ordering and allocate attribution and evidence, with limited spend, deterministic policy checks, and a staffed exception path.
Compare completed purchases or cycle time and contribution against fraud, returns, disputes, abandonment, price or inventory error, integration, monitoring, approval, and exception labor. Establish the lawful basis and data-minimization rules before collecting personal data.
In an isolated environment with written authorization and rules of engagement, test injection, manipulated ranking, stale data, amount or merchant drift, revocation, replay, duplicate orders, substitutions, partial fulfillment, returns, and disputed receipts.
The commercial gate asks whether the flow improves the outcome after all exception cost. The assurance gate asks whether the correct authorities accept the authorization, evidence, revocation, and remedy path. One pass is not enough.
Start with one purchase class whose baseline, approvers, contracts, counterparties, and exception owners already exist. Make that flow callable, measure its net economics, and reconstruct every approval and remedy from the receipt. Widen only when both the commercial and assurance gates pass.
Claim ledger
The evidence does not show that agent commerce already produces material incremental GMV, conversion, or margin; that any benchmark supplies a production fraud or loss rate; or that one delegation design transfers across transaction types and jurisdictions. Protocol activity is an adoption signal, not a business outcome.
- An audited multi-merchant or multi-enterprise study reports agent-originated completed purchases or cycle time alongside contribution, fraud, returns, disputes, and exception cost on one lawful denominator.
- A scaled operator discloses protocol adoption, agent transaction volume, take rate, loss, dispute, or return economics.
- A court, legislature, or regulator materially clarifies attribution, disclosure, payment authorization, product liability, or consumer remedy for agent-mediated transactions.
- A leading protocol reaches general availability with documented unattended production transactions.
- A peer-reviewed production study tests injection, ranking manipulation, revocation, and recovery in real purchases rather than simulated tasks.